Describe the enhancement:
It would be really nice to be able to use this additional authentication mechanism when running metricbeat inside Elastic Kubernetes Service (specially when using the AWS Module).
Describe a specific use case for the enhancement or feature:
I tried to configure metricbeat following the AWS official documentation Specifying an IAM role for your service account (we use this approach successfully with other components like ALB Ingress Controller, External DNS, Fluxcd and so on) and even if I change the container permissions to be able to read the token file (fsGroup: 472) metricbeat insists to use the worker node role (which is not what we want).
We are using metricbeat version 7.8.0.
This feature would enable more flexibility and security since metricbeat requires some additional permissions that may not be desirable to share with all pods running on the same cluster.
Follow the configuration we tried to use on metricbeat deployment (setting fsGroup to 472 works for other deployments):
securityContext:
fsGroup: 472
runAsGroup: 472
runAsUser: 0
We don't manually specify any AWS auth related env because AWS does that for us (when using IRSA) and with that the AWS SDK should detect the injected environments (AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE).
Thanks.
Describe the enhancement:
It would be really nice to be able to use this additional authentication mechanism when running metricbeat inside Elastic Kubernetes Service (specially when using the AWS Module).
Describe a specific use case for the enhancement or feature:
I tried to configure metricbeat following the AWS official documentation Specifying an IAM role for your service account (we use this approach successfully with other components like ALB Ingress Controller, External DNS, Fluxcd and so on) and even if I change the container permissions to be able to read the token file (fsGroup: 472) metricbeat insists to use the worker node role (which is not what we want).
We are using metricbeat version 7.8.0.
This feature would enable more flexibility and security since metricbeat requires some additional permissions that may not be desirable to share with all pods running on the same cluster.
Follow the configuration we tried to use on metricbeat deployment (setting fsGroup to 472 works for other deployments):
We don't manually specify any AWS auth related env because AWS does that for us (when using IRSA) and with that the AWS SDK should detect the injected environments (AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE).
Thanks.